Your Reg S-P Compliance Deadline Passed in June. Now the SEC Is Examining for It.

TL;DR

• The SEC’s June 3, 2026 Regulation S-P compliance deadline for smaller entities has passed — both the December 2025 and June 2026 deadlines are now in the rearview mirror
• The 2024 amendments require a written incident response program, 30-day customer notification for “sensitive customer information” breaches, and service provider oversight including 72-hour contractual notification requirements
• The SEC Division of Examinations’ 2026 priorities explicitly flag Reg S-P compliance as an examination target for broker-dealers and investment advisers
• Smaller RIAs and broker-dealers are the highest-risk population — they faced the later deadline, have fewer compliance resources, and are more likely to lack documented programs
• Service provider gap is the most common compliance miss: most firms haven’t updated vendor contracts to include the 72-hour breach notification clause

The deadline was June 3, 2026.

For smaller broker-dealers and investment advisers — those with under $1.5 billion in AUM, under $1 billion in fund net assets, or qualifying as “small entities” under the Securities Exchange Act — that was the date the SEC’s amended Regulation S-P became mandatory. Larger entities had until December 3, 2025.

Both deadlines are now past. The obligations apply. And the SEC’s own examination priorities document specifically names Reg S-P as something examiners are testing in 2026.

If you’re running a small RIA or an independent broker-dealer and you haven’t built out the incident response program, the customer notification procedures, and the service provider oversight requirements the 2024 amendments require, you’re already out of compliance. The question now isn’t whether to start — it’s how quickly you can close the gap before an exam raises it.

What the 2024 Amendments Actually Changed

Regulation S-P has been around since 2000, governing how broker-dealers, investment advisers, and investment companies handle nonpublic personal information about their customers. The May 2024 amendments were the first major overhaul in 24 years. They added three new obligations on top of the existing Safeguards Rule requirements, and dramatically raised the bar for what SEC examiners will expect to see.

1. Written Incident Response Program

Every covered institution must maintain written policies and procedures for an incident response program. Not a general cybersecurity policy. Not an IT disaster recovery plan. A specific incident response program that addresses the identification, containment, assessment, and notification steps when customer data may have been accessed without authorization.

The program must be reasonably designed — meaning it needs to reflect the actual size, scope, and risk profile of the institution. A three-person RIA and a 200-person broker-dealer have different programs. What they share is the requirement to have one in writing.

Key elements the SEC has indicated it expects in a compliant program:

• How the firm identifies a potential unauthorized access incident
• How it determines whether “sensitive customer information” was involved
• Who owns the notification decision and escalation path
• How the 30-day notification clock is managed
• How service provider breach notices are handled and escalated

2. 30-Day Customer Notification

When a covered institution determines that “sensitive customer information” was or is reasonably likely to have been accessed without authorization, it must notify each affected individual — unless the firm determines, after a reasonable investigation, that the data has not been and is not reasonably likely to be misused in a way that causes substantial harm.

The 30-day clock starts from awareness, not from confirmed misuse. That’s a meaningful difference. A firm that learns a vendor’s system was breached and customer account data was in scope needs to start the clock the day it learns that — not after forensics confirms actual data theft.

What counts as sensitive customer information? The 2024 amendments define it as a customer’s name combined with one or more of: Social Security or taxpayer ID number; driver’s license, passport, or similar government ID; account number, credit or debit card number; access credentials (password, PIN, security code); biometric data; or medical, health, or financial information.

That last category — financial information — is broad. For most broker-dealers and RIAs, a breach affecting customer account data and transaction history is likely to trigger the notification requirement.

3. Service Provider Oversight

This is the requirement most firms haven’t fully addressed.

The 2024 amendments require every covered institution to include service provider oversight in its incident response program. “Service provider” is defined broadly: any person or entity that receives, maintains, processes, or otherwise has access to customer information through its provision of services to the covered institution.

That means your cloud hosting provider, your portfolio management software vendor, your email provider, your document management system, your CRM — if they touch customer information, they’re a service provider for Reg S-P purposes.

The oversight obligations have two main components:

Due diligence and monitoring. The covered institution must conduct due diligence on service providers before engagement and monitor their security practices on an ongoing basis.

72-hour contractual notification. Service provider agreements must require the service provider to notify the covered institution as soon as possible, and no later than 72 hours after becoming aware that a security breach has resulted in unauthorized access to customer information. Without this clause in the contract, the covered institution cannot satisfy the oversight requirement — regardless of how good the service provider’s own security practices are.

Most firms that had vendor contracts in place before June 2026 have not updated those contracts. That’s the gap that shows up first in examinations.

Where the SEC Is Looking in 2026

The SEC Division of Examinations’ 2026 priorities document — published in November 2025 and covering the examination cycle that’s running now — specifically calls out Reg S-P compliance as a target.

Examiners are testing readiness for the 2024 amendments, including:

• Whether covered institutions have implemented incident response programs that are actually written down and operationally functional — not just policies adopted on paper the week before the deadline
• Whether programs include specific procedures for customer notification, including the 30-day clock, scope assessment, and the carve-out determination
• Whether service provider agreements include the 72-hour breach notification requirement
• Whether the institution has documentation of due diligence on service providers that access customer data
• Whether the institution is maintaining five-year records of the incident response program and any notifications sent

The exam population the SEC is prioritizing includes both the larger entities that had the December 2025 deadline (and have had more time to build compliant programs) and the smaller entities that hit the June 2026 deadline. For smaller firms, the practical reality is that many haven’t had the resources to build comprehensive programs — and examiners know that.

The Most Common Compliance Gaps Right Now

Based on the trajectory of the amendments and the practical constraints facing smaller firms, the gaps showing up most frequently are:

Missing service provider contract clauses. A firm’s incident response program can be fully drafted and the notification procedures can be solid — but if the vendor contracts don’t include the 72-hour notification requirement, the firm cannot satisfy the oversight component of the rule. Updating vendor contracts requires identifying every vendor with customer data access, reviewing each agreement, and negotiating amendments. Most smaller firms haven’t completed that review.

Notification procedures that exist only on paper. The 2024 amendments require a program, not just a policy. A compliance team that adopted a policy template in May 2026 and hasn’t rehearsed or tested it doesn’t have a functional incident response program — it has a document. Examiners ask to see evidence that the program has been tested and that staff responsible for executing it know what to do.

Scope assessment protocols. The notification obligation turns on whether “sensitive customer information” was involved. That determination requires a defined protocol: who makes the call, what information they need, and how quickly they need to make it. Firms without a documented scope assessment process will struggle to meet the 30-day notification window if an incident actually occurs.

Five-year recordkeeping. The amendments require maintaining records of the incident response program — including documentation of any incidents and notifications — for five years. Firms need to have a recordkeeping process in place, not just the program itself.

What a Compliant Program Looks Like

The SEC’s small entity compliance guide for the 2024 amendments describes the core elements of a compliant incident response program:

The size of the firm affects the complexity of the program — a three-person RIA doesn’t need a 50-page document. But every covered institution needs each of these components addressed in writing, with operational procedures behind each one.

What Smaller RIAs and Broker-Dealers Should Do Now

Step 1: Assess whether your program covers the 2024 elements. If your incident response documentation predates the June 2024 adoption, it almost certainly doesn’t address the 30-day notification requirement, the service provider oversight requirements, or the revised definitions. A gap assessment against the four core obligations (written program, notification procedures, service provider oversight, recordkeeping) is the starting point.

Step 2: Identify your service providers with customer data access. This typically requires a data mapping exercise — which vendors process or access customer information, under what agreements, and with what contractual notification requirements currently in place. The 72-hour notification clause needs to be in every agreement. Vendors that resist this requirement should be evaluated for whether the relationship can continue.

Step 3: Build or update the written program. The written incident response program doesn’t need to be long, but it does need to address every required element. If you don’t have one — or if your existing one doesn’t address the 2024 requirements — build it before the exam finds the gap.

Step 4: Test it. A tabletop exercise — even a simple one-hour walkthrough of a hypothetical breach scenario — demonstrates that the program is operational and that key staff understand their roles. Examiners have repeatedly noted the difference between a firm that has a plan and knows how to use it and a firm that has a plan it has never rehearsed.

Step 5: Document vendor outreach and contract updates. If you’ve identified vendor contracts that don’t include the 72-hour notification clause and you’re in the process of updating them, document that effort. Examiners can distinguish between a firm that hasn’t started and a firm that is actively working through a vendor contract review.

The Exam Exposure

The risk isn’t abstract. The SEC’s 2026 exam priorities document is a reliable predictor of what gets cited in deficiency letters. When examiners flag Reg S-P compliance — and they will, for the population of smaller entities that just crossed the June deadline — the typical outcome is a deficiency letter with required remediation. Repeat failures or complete non-compliance can escalate to enforcement referral.

The pattern the SEC has established in cybersecurity and data security enforcement is consistent: first examinations find deficiencies, deficiency letters require remediation, and follow-up exams verify completion. Firms that addressed the June 2026 deadline by adopting a policy document without building the operational infrastructure behind it are likely to get a deficiency letter when they’re examined. Firms that haven’t addressed it at all are in a worse position.

The window between now and a first examination cycle for most smaller entities is not unlimited. If your Reg S-P program isn’t built, start building it.

So What?

The Reg S-P 2024 amendments aren’t complicated, but they require operational work that goes beyond policy adoption. The SEC built in generous compliance timelines — 18 and 24 months — because they knew implementation required real effort. Now that both deadlines have passed, examiners aren’t in the business of explaining the requirements. They’re checking whether you’ve met them.

The three things most likely to trip up a smaller firm in an examination:

1. Service provider contracts without the 72-hour notification clause. This is the most common gap and the hardest to fix quickly — it requires renegotiating agreements with every vendor that touches customer data.

2. A policy that hasn’t been operationalized. If no one has rehearsed the 30-day notification process, it doesn’t exist in any meaningful sense.

3. No recordkeeping system for incidents and notifications. The five-year retention requirement isn’t optional, and “we haven’t had any incidents” isn’t a sufficient record.

For broker-dealers and RIAs that haven’t completed their Reg S-P buildout, the message from the 2026 exam priorities is clear: the SEC is checking, and they’re checking now.

Related reading: What the SEC’s Cybersecurity Forensic Evidence Requirements Mean for Your First Four Hours After a Breach • NYDFS Fined a Money Transmitter $250K for Its Risk Assessment, Not the Ransomware • State Breach Notification Laws: A 50-State Comparison

If you need a functional incident response kit that already includes the Reg S-P 30-day notification clock alongside the bank regulators’ 36-hour rule, NYDFS requirements, and breach notification rules for 54 jurisdictions, the Incident Response & Breach Notification Kit gives you a 12-tab Excel workbook, four playbooks, and an editable Word template for your written incident response plan — $69.